Hacker News Reader

a904guyon The beauty of a text only webpage

I wasn't. I indeed find the site to be fun, and fits the author's own words.

> “So thank you to everybody who writes and publishes text-only webpages.”

The site is 100% text.

a904guyon The beauty of a text only webpage

Guilty on the splash. Regardless the entire site is clean text, fast loads, no images, and no blockers.

In the author's own words:

> “So thank you to everybody who writes and publishes text-only webpages.”

a904guyon Smart Segments: Krita plugin that adds Segment Anything V2 object selection

I built a Krita plugin called Smart Segments that lets you easily select objects using Meta’s Segment Anything Model (SAM v2). Just run the tool, and it automatically finds everything on the current layer. You can click or shift-click to choose one or more segments, and it converts them into a selection. No more struggling with the magic wand or cutting stuff out by hand. It supports GPU and CPU, works on Windows, macOS, and Linux, and sets everything up on first run without needing to install anything manually.

a904guyon Show HN: Liveform. Creating an Imgur Clone Using GitHub Pages and Liveform

Didn't really take your own advice in keeping your API key safe :)

a904guyon SQL Injection Galore

I always preferred the remote code execution search myself personally...

https://github.com/search?q=extension%3Aphp+exec+%24_GET&typ...

a904guyon ArXiv vs snarXiv

Oops: Was going for the high score...

OperationalError: (1203, "User #### already has more than 'max_user_connections' active connections")

a904guyon ArXiv vs snarXiv

Nobel Prize Winner ( aka Ed ) goes to:

$("a:contains("+arxiv['title']+")").click();

a904guyon Show HN: My HTML5 Game for Github Game Off

mit.score = 1337000000001337;

a904guyon Bootstrap Toggle Buttons

#1: Not really impossible, just requires additional maintaining of a monitor, methods within the script, or custom triggers to handle the switch.

a904guyon Bootstrap Toggle Buttons

Looks great.

Two things,

#1: If you modify the attribute checked of the input, the state doesn't change.

#2: I don't see a programmatic way of changing the state from your source without re-initializing all the elements?

a904guyon Why Is The Defense Department Snooping On My Phone?

A (extremely) large number of usual local network IP ranges are issued to the DOD. Including my local subnet as well. 11.1.11.0/24, if I ran a whois on that IP as well, it would return DOD, but that doesn't mean the DOD is snooping my network, it just means my router has all the routes for 11.1.11.0/24 associated with it and doesn't actually attempt to send traffic over the wire to that IP. I assume your Android phone is listening locally on that address for the VOIP communication, which would in return mean the DOD is NOT snooping on your phone. Much similar to apache or (insert other socket application) listening to 127.0.0.1:80 for local only traffic.

a904guyon Introducing MotionCAPTCHA: Stop Spam, Draw Shapes

As far as I can tell from the demo there is no server side validation on this captcha. Everything is handled on the client side. So really all your doing is making an annoyance for your honest target users. And allowing a spam bot to just totally ignore this 'captcha' to submit their POST regardless....

I've seen hundreds of these 'alternative' captchas. 'slide to unlock', 'sort images' ect. None yet have proven to be as effective at stopping a simple curl script.

Real captchas will store the value of the image or verification method on the first fetch in a session, and when the form is finally filled out the server will verify that the session value matches the submitted value. Without this component, the alternative captchas are pointless and just an annoyance to your real users.

Spam bots are not built on top of web browsers...

a904guyon SSH Key Gen/Install Script. Automates Mass Distribution of SSH Keys

Ahh! good catch, Thank you. I'll zdd that in tomorrow.

a904guyon SSH Key Gen/Install Script. Automates Mass Distribution of SSH Keys

... well. Since we are going deep down the rabbit hole. So your machines other users are potentially a threat. Considering that the folder and contents are chmod 600. Only the owning user and root can see them. The key pass is pointless without the key files.

While we are on the subject. Lets dig deeper on this situation. Whats stopping your rouge user on the same box (that can dump the proc table while ssh-keygen is executing in ms) from dumping the ram to extract the stdin password typed out by keyboard then?

If you already have fear of a user INSIDE your box. SSH keys should be the least of your concerns.

a904guyon SSH Key Gen/Install Script. Automates Mass Distribution of SSH Keys

For the ability to remove a key from a single device/server. Considering the keys are tagged with user+host, removal is easily identifiable. A single key solution isn't ideal for my configuration.

Using ssh-copy-id is the standard method, but doesn't suite what I wanted.

a904guyon SSH Key Gen/Install Script. Automates Mass Distribution of SSH Keys

When you run ssh-keygen it creates the two keys, public and private, neither contain the 'plaintext' passphrase in your home directory like you mentioned. The only concern may be bash history, I'll include a wipe for that. Secondly, even while being transmitted using SSH they are NOT in plain-text. As the SSH connection itself is encrypted, so while executed in plaintext, the password is NOT stored in plain text, or transmitted in plaintext as identified by those commands.

Finally, the remote_password being blank is by design, passwordless keys are less of a security threat than any weak user supplied password. They serve their purpose in the real world amongst private networks.

EDIT for 'and in the command line.': Reviewing the command history doesn't show the libssh2 or php5 commands being executed on either BSD or debian.

EDIT for your comment 'in the config file': If your suggesting that the software is insecure by the fact that the user leaves the config file after usage, then perhaps that user should be allowed in the environment to begin with.

a904guyon SSH Key Gen/Install Script. Automates Mass Distribution of SSH Keys

The language doesn't really matter, especially considering its a single use app. It can be done via any LibSSH2 binding, or even with a more complex expect binding.

The reason for php is simple, I had already wrote the libssh2 code for what I needed. I submitted it, in hopes it saves someone else the time.

a904guyon SSH Key Gen/Install Script. Automates Mass Distribution of SSH Keys

MediaTemple VPS... Time to migrate to my rackspace server.

a904guyon SSH Key Gen/Install Script. Automates Mass Distribution of SSH Keys

For your comment that was edited stating: "the script was storing passwords in plain-text in the user home folder", There is no plaintext passphrases stored anywhere... and you can use different passwords per each device per the config file. This script follows the exact procedure for ssh-keys defined by OpenSSHD in general, ssh-keys are more secure than logging in using a password in general. As for the reverse connections, I have a version that utilizes the reverse key in the config array that keeps them from distributing across server, only to and from the localhost. I took it out to roll this version out as I still haven't tested it fully.

a904guyon Torrent meta-search engine

I love the interface. I give you my up-vote.

a904guyon Complete Hacker Tutorial to getting Time Machine over NFS to work.

It works out great for me. I work primarily on a Ubuntu Desktop but for my Mac Air, all my files are on other servers, so really I only have locally Xcode and my development tools.

I assume everyones situation is different, I wouldn't be attempting to use TimeCode on a couple TB drives of a MacPro tower.

a904guyon Complete Hacker Tutorial to getting Time Machine over NFS to work.

I thought the same. I tested EXT4 on a fresh Ubuntu 10.10 system. My variables wouldn't save till I declared it.

a904guyon Complete Hacker Tutorial to getting Time Machine over NFS to work.

I've already implemented AFP via netatalk. I'll do a write up on the process in a bit.

Personally I don't much care for SMB... but I've implemented it as well for our Windows boxes to backup over.

a904guyon Complete Hacker Tutorial to getting Time Machine over NFS to work.

The restore works just like any other Time Machine restore. In critical data loss when the machine has to be formatted. You will be able to restore the system completely from the Time Machine. Just remount the NFS on the new OS and run to command so Time Machine will see NFS mounts and click Restore.